القائمة
WAF bypass techniques checklist for Azure Front Door and Application Gateway. Covers encoding bypass, header manipulation, and Azure-specific evasion strategies.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Identifies and remediates non-quantum-safe cryptographic configurations in Azure including classical TLS key exchange, RSA and ECC keys in Key Vault, and classical certificate algorithms. Maps findings to NIST PQC standards FIPS 203, FIPS 204, and FIPS 205. Use when assessing quantum readiness of Azure infrastructure or building a Cryptographic Bill of Materials.
Queries Azure Monitor activity logs and sign-in logs to detect suspicious administrative operations, impossible travel, and privilege escalation.
Detect abnormal access patterns in Azure Blob Storage by analyzing Storage Analytics and diagnostic logs. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetBlob spikes), and potential data exfiltration.
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, and guest user risks.
Conduct cloud security audits using Center for Internet Security (CIS) benchmarks for Azure. Covers interpreting CIS Foundations Benchmark controls, running automated assessments, and maintaining continuous compliance monitoring.
Deploy Microsoft Sentinel as a cloud-native SIEM and SOAR platform for Azure. Covers configuring data connectors (Entra ID, Azure Activity), writing KQL detection queries, and building automated response playbooks.
| name | offensive-waf-bypass |
| description | WAF bypass techniques checklist for Azure Front Door and Application Gateway. Covers encoding bypass, header manipulation, and Azure-specific evasion strategies. |
| domain | cybersecurity |
| subdomain | web-security |
| tags | ["waf","azure-front-door","application-gateway","evasion","web-security"] |
| version | 1.0 |
| author | openshield |
| license | Apache-2.0 |
| nist_csf | ["PR.AC-3","PR.AC-5","SI-3","PR.DS-1","DE.CM-1"] |
| Term | Definition |
|---|---|
| CRS | Common Rule Set, the base rules used by Azure WAF (e.g., OWASP 3.2) |
| Front Door | Azure's global CDN and security layer with integrated WAF |
| App Gateway | Azure's regional load balancer with integrated WAF |
| Origin Bypass | Directly connecting to the backend IP/hostname to skip WAF inspection |
If the backend application (App Service, VM) is not restricted to Front Door/App Gateway IPs, an attacker can bypass the WAF entirely.
# Test if origin is reachable directly
curl -v https://<backend-ip-or-dns>/api/test
Azure WAF (CRS) can sometimes be bypassed using specific encoding combinations that the WAF doesn't normalize but the backend does.
UNION → %2555%254E%2549%254F%254ESeLeCt instead of SELECTUN/**/ION SE/**/LECTSome WAF rules can be confused by malformed or duplicate headers.
X-Forwarded-For: 1.2.3.4 followed by X-Forwarded-For: 127.0.0.1